@things-factory/auth-base 8.0.5 → 9.0.0-beta.12

package/server/controllers/unlock-user.ts

@@ -1,61 +0,0 @@
-import { URL } from 'url'
-
-import { sendEmail } from '@things-factory/email-base'
-import { getRepository } from '@things-factory/shell'
-
-import { User, UserStatus } from '../service/user/user'
-import { VerificationToken, VerificationTokenType } from '../service/verification-token/verification-token'
-import { getUnlockUserEmailForm } from '../templates/account-unlock-email'
-import { makeVerificationToken } from './utils/make-verification-token'
-import { saveVerificationToken } from './utils/save-verification-token'
-
-export async function sendUnlockUserEmail({ user, context }) {
-  try {
-    var token = makeVerificationToken()
-    var verifaction = await saveVerificationToken(user.id, token, VerificationTokenType.UNLOCK)
-
-    if (verifaction) {
-      var serviceUrl = new URL(`/auth/unlock-user?token=${token}`, context.header.referer)
-      await sendEmail({
-        receiver: user.email,
-        subject: 'Your account is locked',
-        content: getUnlockUserEmailForm({
-          name: user.name,
-          resetUrl: serviceUrl
-        })
-      })
-
-      return true
-    }
-  } catch (e) {
-    return false
-  }
-}
-
-export async function unlockUser(token, password) {
-  var { userId } = await getRepository(VerificationToken).findOne({
-    where: {
-      token,
-      type: VerificationTokenType.UNLOCK
-    }
-  })
-
-  if (!userId) return false
-
-  var userInfo = await getRepository(User).findOneBy({ id: userId })
-  if (!userInfo) return false
-  if (userInfo.status != UserStatus.LOCKED) return false
-
-  userInfo.status = UserStatus.ACTIVATED
-  userInfo.password = User.encode(password, userInfo.salt)
-  userInfo.failCount = 0
-
-  await getRepository(User).save(userInfo)
-  await getRepository(VerificationToken).delete({
-    userId,
-    token,
-    type: VerificationTokenType.UNLOCK
-  })
-
-  return true
-}

package/server/controllers/utils/make-invitation-token.ts

@@ -1,5 +0,0 @@
-import crypto from 'crypto'
-
-export function makeInvitationToken() {
-  return crypto.randomBytes(16).toString('hex')
-}

package/server/controllers/utils/make-verification-token.ts

@@ -1,4 +0,0 @@
-import crypto from 'crypto'
-export function makeVerificationToken() {
-  return crypto.randomBytes(16).toString('hex')
-}

package/server/controllers/utils/password-rule.ts

@@ -1,120 +0,0 @@
-import i18next from 'i18next'
-
-import { config } from '@things-factory/env'
-
-import { PASSWORD_PATTERN_NOT_MATCHED } from '../../constants/error-code'
-import { AuthError } from '../../errors/auth-error'
-
-const passwordConfig = config.get('password') || {
-  lowerCase: true,
-  upperCase: true,
-  digit: true,
-  specialCharacter: true,
-  allowRepeat: false,
-  useTightPattern: true,
-  useLoosePattern: false,
-  tightCharacterLength: 8,
-  looseCharacterLength: 15
-}
-
-function generatePasswordPatternRegExp({
-  lowerCase = true,
-  upperCase = true,
-  digit = true,
-  specialCharacter = true,
-  allowRepeat = false,
-  useTightPattern = true,
-  useLoosePattern = false,
-  tightCharacterLength = 8,
-  looseCharacterLength = 15
-} = {}) {
-  var tightChecklist = useTightPattern
-    ? [
-        lowerCase ? '(?=.*[a-z])' : '', // has at least one lower case character
-        upperCase ? '(?=.*[A-Z])' : '', // has at least one upper case character
-        digit ? '(?=.*\\d)' : '', // has at least one digit
-        specialCharacter ? '(?=.*[!@#$%^&*()])' : '', // has at least one special character
-        !allowRepeat ? '(?!.*(.)\\1(?=\\1{1,}))' : '', // has not an repeated character more than twice
-        `.{${tightCharacterLength},}` // has a length of 8 and more
-      ]
-    : []
-
-  var looseChecklist = useLoosePattern
-    ? [
-        `.{${looseCharacterLength},}` // has a length of 15 and more
-      ]
-    : []
-
-  var checkList = [
-    '^', // from start
-    ...tightChecklist,
-    tightChecklist.length && looseChecklist.length ? '|' : '',
-    ...looseChecklist,
-    '$' //to the end"
-  ]
-
-  return new RegExp(checkList.join(''))
-}
-
-export function generatePasswordPatternHelp(
-  {
-    lowerCase = true,
-    upperCase = true,
-    digit = true,
-    specialCharacter = true,
-    allowRepeat = false,
-    useTightPattern = true,
-    useLoosePattern = false,
-    tightCharacterLength = 8,
-    looseCharacterLength = 15
-  } = {},
-  lng
-) {
-  lng = lng || 'en-US'
-  var descriptions = []
-
-  const t = i18next.getFixedT(lng, 'translations')
-
-  if (useLoosePattern) {
-    descriptions.push(`more than ${looseCharacterLength} characters`)
-  }
-
-  if (useTightPattern) {
-    !useLoosePattern &&
-      descriptions.push(
-        t('text.pattern_minimum_charaters', {
-          length: tightCharacterLength
-        })
-      )
-    lowerCase && descriptions.push(t('text.pattern_atleast_1_lowercase'))
-    upperCase && descriptions.push(t('text.pattern_atleast_1_uppercase'))
-    digit && descriptions.push(t('text.pattern_atleast_1_digit'))
-    specialCharacter && descriptions.push(t('text.pattern_atleast_1_special'))
-    !allowRepeat && descriptions.push(t('text.pattern_not_allowed'))
-  }
-
-  return descriptions.join(', ')
-}
-
-export const passwordPattern = generatePasswordPatternRegExp(passwordConfig)
-export function passwordHelp(lng) {
-  return generatePasswordPatternHelp(passwordConfig, lng)
-}
-
-export function validatePasswordByRule(password, lng) {
-  if (!passwordPattern) {
-    return
-  }
-
-  if (passwordPattern.test(password)) {
-    return
-  }
-
-  const rule = generatePasswordPatternHelp(passwordConfig, lng)
-  throw new AuthError({
-    errorCode: PASSWORD_PATTERN_NOT_MATCHED,
-    detail: {
-      rule
-    }
-  })
-}

package/server/controllers/utils/save-invitation-token.ts

@@ -1,10 +0,0 @@
-import { getRepository } from '@things-factory/shell'
-
-import { Invitation } from '../../service/invitation/invitation'
-
-export async function saveInvitationToken(id, token) {
-  return await getRepository(Invitation).save({
-    id,
-    token
-  })
-}

package/server/controllers/utils/save-verification-token.ts

@@ -1,12 +0,0 @@
-import { getRepository } from '@things-factory/shell'
-
-import { VerificationToken, VerificationTokenType } from '../../service/verification-token/verification-token'
-
-export async function saveVerificationToken(id, token, type = VerificationTokenType.ACTIVATION) {
-  const verificationRepo = getRepository(VerificationToken)
-  return await verificationRepo.save({
-    userId: id,
-    token,
-    type
-  })
-}

package/server/controllers/verification.ts

@@ -1,83 +0,0 @@
-import { URL } from 'url'
-
-import { sendEmail } from '@things-factory/email-base'
-import { getRepository } from '@things-factory/shell'
-
-import { AuthError } from '../errors/auth-error'
-import { User, UserStatus } from '../service/user/user'
-import { VerificationToken } from '../service/verification-token/verification-token'
-import { getVerificationEmailForm } from '../templates/verification-email'
-import { makeVerificationToken } from './utils/make-verification-token'
-import { saveVerificationToken } from './utils/save-verification-token'
-
-export async function sendVerificationEmail({ user, context }) {
-  try {
-    var token = makeVerificationToken()
-    var verifaction = await saveVerificationToken(user.id, token)
-
-    if (verifaction) {
-      var serviceUrl = new URL(`/auth/verify/${token}`, context.header.referer)
-      await sendEmail({
-        receiver: user.email,
-        subject: 'Verify your email',
-        content: getVerificationEmailForm({
-          name: user.name,
-          verifyUrl: serviceUrl
-        })
-      })
-
-      return true
-    }
-  } catch (e) {
-    return false
-  }
-}
-
-export async function verify(token) {
-  var verification = await getRepository(VerificationToken).findOne({
-    where: {
-      token
-    }
-  })
-
-  if (!verification) {
-    throw new AuthError({
-      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR
-    })
-  }
-
-  var userInfo = await getRepository(User).findOneBy({ id: verification.userId })
-  if (!userInfo) {
-    throw new AuthError({
-      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR
-    })
-  }
-
-  if (!(userInfo.status == UserStatus.INACTIVE || userInfo.status == UserStatus.LOCKED)) {
-    throw new AuthError({
-      errorCode: AuthError.ERROR_CODES.VERIFICATION_ERROR
-    })
-  }
-
-  userInfo.status = UserStatus.ACTIVATED
-  userInfo.failCount = 0
-
-  await getRepository(User).save(userInfo)
-  await getRepository(VerificationToken).delete(verification)
-}
-
-export async function resendVerificationEmail(email, context) {
-  var user = await getRepository(User).findOne({
-    where: {
-      email
-    }
-  })
-
-  if (!user) return false
-  if (user.status == UserStatus.ACTIVATED) return false
-
-  return await sendVerificationEmail({
-    user,
-    context
-  })
-}

package/server/errors/auth-error.ts

@@ -1,24 +0,0 @@
-import * as ERROR_CODES from '../constants/error-code'
-
-type AuthErrorArgument = {
-  errorCode: string
-  detail?: Object
-}
-export class AuthError extends Error {
-  static get ERROR_CODES(): any {
-    return {
-      ...ERROR_CODES
-    }
-  }
-
-  errorCode: any
-  detail: Object
-
-  constructor({ errorCode, detail }: AuthErrorArgument) {
-    super(errorCode)
-
-    this.name = 'auth-error'
-    this.errorCode = errorCode
-    this.detail = detail
-  }
-}

package/server/errors/index.ts

@@ -1,2 +0,0 @@
-export * from './auth-error'
-export * from './user-domain-not-match-error'

package/server/errors/user-domain-not-match-error.ts

@@ -1,29 +0,0 @@
-import {
-  NO_AVAILABLE_DOMAIN,
-  NO_SELECTED_DOMAIN,
-  REDIRECT_TO_DEFAULT_DOMAIN,
-  UNAVAILABLE_DOMAIN
-} from '../constants/error-code'
-import { AuthError } from './auth-error'
-
-export class DomainError extends AuthError {
-  static get ERROR_CODES(): any {
-    return {
-      UNAVAILABLE_DOMAIN,
-      NO_AVAILABLE_DOMAIN,
-      NO_SELECTED_DOMAIN,
-      REDIRECT_TO_DEFAULT_DOMAIN
-    }
-  }
-
-  domains: any
-
-  constructor({ errorCode = UNAVAILABLE_DOMAIN, domains }) {
-    super({
-      errorCode
-    })
-
-    this.name = 'user-domain-not-match'
-    this.domains = domains
-  }
-}

package/server/index.ts

@@ -1,37 +0,0 @@
-import { getRepository } from '@things-factory/shell'
-import { Privilege } from './service/privilege/privilege'
-
-import './routes'
-
-export * from './service'
-export * from './migrations'
-
-export * from './middlewares'
-export * from './routes'
-export * from './router'
-
-export * from './utils/get-domain-users'
-export * from './utils/get-user-domains'
-export * from './utils/get-secret'
-export * from './utils/check-user-belongs-domain'
-export * from './utils/access-token-cookie'
-export * from './utils/encrypt-state'
-export * from './utils/check-permission'
-export * from './utils/check-user-has-role'
-
-export * from './errors'
-
-export * from './types'
-
-process.on('bootstrap-module-start' as any, async ({ app, config, client }: any) => {
-  const privileges = process['PRIVILEGES']
-  const privilegeRepository = getRepository(Privilege)
-
-  for (const [category, name] of Object.values(privileges as [string, string])) {
-    if (0 == (await privilegeRepository.count({ where: { category, name } }))) {
-      await privilegeRepository.save({ category, name })
-    }
-  }
-
-  console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.')
-})

package/server/middlewares/authenticate-401-middleware.ts

@@ -1,114 +0,0 @@
-import { config } from '@things-factory/env'
-
-import { SUBDOMAIN_NOTFOUND, USER_DUPLICATED, USER_LOCKED, USER_NOT_ACTIVATED } from '../constants/error-code'
-import { AuthError } from '../errors/auth-error'
-import { accepts } from '../utils/accepts'
-
-const disableUserSignupProcess = config.get('disableUserSignupProcess', false)
-const disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)
-const languages = config.get('i18n/languages', false)
-
-export async function authenticate401Middleware(context, next) {
-  try {
-    await next()
-  } catch (err) {
-    var message
-
-    if (err instanceof AuthError) {
-      message = (context.t && context.t(`error.${err.errorCode}`, err.detail || {})) || err.errorCode
-    } else {
-      if (err?.status !== 401) {
-        throw err
-      }
-
-      message = err.message
-    }
-
-    context.status = 401
-    context.body = message
-
-    /*
-     * 클라이언트 라우팅을 위한 ApiHistoryFallback의 상황과,
-     * 서버라우팅의 상황에서 발생하는 던져지는 401 에러인 경우에는
-     * error code에 맞춰서 적절하게 rewriting 되도록 한다.
-     */
-
-    const { method, header, path, originalUrl } = context
-
-    if (method == 'POST' && path.startsWith('/graphql')) {
-      if (err.errorCode == SUBDOMAIN_NOTFOUND) {
-        context.status = 403
-      }
-      return
-    }
-
-    if (!accepts(header.accept, ['text/html', '*/*'])) {
-      return
-    }
-
-    const { redirect_to } = context.query
-    const { redirectTo = redirect_to || originalUrl } = context.request.body || {}
-
-    switch (err.errorCode) {
-      case SUBDOMAIN_NOTFOUND:
-        context.redirect(`/auth/checkin?redirect_to=${encodeURIComponent(redirectTo)}`)
-        break
-
-      case USER_LOCKED:
-        return await context.render('auth-page', {
-          pageElement: 'auth-activate',
-          elementScript: '/auth/activate.js',
-          data: {
-            ...err.detail,
-            message,
-            redirectTo,
-            disableUserSignupProcess,
-            disableUserFavoredLanguage,
-            languages
-          }
-        })
-
-      case USER_NOT_ACTIVATED:
-        return await context.render('auth-page', {
-          pageElement: 'auth-activate',
-          elementScript: '/auth/activate.js',
-          data: {
-            ...err.detail,
-            message,
-            redirectTo,
-            disableUserSignupProcess,
-            disableUserFavoredLanguage,
-            languages
-          }
-        })
-
-      case USER_DUPLICATED:
-        return await context.render('auth-page', {
-          pageElement: 'auth-signup',
-          elementScript: '/auth/signup.js',
-          data: {
-            ...err.detail,
-            message,
-            redirectTo,
-            disableUserSignupProcess,
-            disableUserFavoredLanguage,
-            languages
-          }
-        })
-
-      default:
-        return await context.render('auth-page', {
-          pageElement: 'auth-signin',
-          elementScript: '/auth/signin.js',
-          data: {
-            ...err.detail,
-            message: err instanceof AuthError ? message : '',
-            redirectTo,
-            disableUserSignupProcess,
-            disableUserFavoredLanguage,
-            languages
-          }
-        })
-    }
-  }
-}

package/server/middlewares/domain-authenticate-middleware.ts

@@ -1,78 +0,0 @@
-import { config } from '@things-factory/env'
-import { Domain, getRepository } from '@things-factory/shell'
-
-import { AuthError } from '../errors/auth-error'
-import { User } from '../service/user/user'
-import { getUserDomains } from '../utils/get-user-domains'
-
-const useVirtualHostBasedDomain = !!config.get('useVirtualHostBasedDomain')
-const fixed = config.get('subdomain')
-const subdomainOffset = config.getNumber('subdomainOffset', 2)
-
-declare global {
-  namespace NodeJS {
-    interface Process {
-      domainOwnerGranted: (domain: Domain, user: User) => Promise<boolean>
-      superUserGranted: (domain: Domain, user: User) => Promise<boolean>
-    }
-  }
-}
-
-process.domainOwnerGranted = async (domain: Domain, user: User): Promise<boolean> => {
-  return user && domain && domain.owner === user.id
-}
-
-process.superUserGranted = async (domain: Domain, user: User): Promise<boolean> => {
-  if (!user) {
-    return false
-  }
-
-  if (!user.domains.length) {
-    user = await getRepository(User).findOne({
-      where: { id: user.id },
-      relations: ['domains']
-    })
-  }
-
-  const systemDomain: Domain = user.domains.find((domain: Domain) => domain.subdomain === 'system')
-  if (!systemDomain) {
-    return false
-  }
-
-  return systemDomain.owner === user.id
-}
-
-/*
- * 현재 subdomain 과 user의 domain list와의 비교를 통해서,
- * 인증 성공 또는 인증 에러를 발생시킬 것인지를 결정한다.
- * 1. 현재 subdomain 이 결정되지 않은 경우.
- * - checkin로 이동한다.
- * 2. superUser 판단
- * 3. 현재 subdomain 이 결정된 경우.
- * - user의 domains 리스트에 해당 subdomain이 없다면, 인증 오류를 발생한다.
- */
-
-export async function domainAuthenticateMiddleware(context: any, next: any) {
-  const { t } = context
-  const { domain, user } = context.state
-
-  const subdomain: string = domain?.subdomain
-
-  // 1. 현재 subdomain 이 결정되지 않은 경우.
-  // - checkin로 이동한다.
-  if (!subdomain) {
-    throw new AuthError({
-      errorCode: AuthError.ERROR_CODES.SUBDOMAIN_NOTFOUND
-    })
-  }
-
-  // 2. 현재 subdomain 이 결정된 경우.
-  const userDomains: Partial<Domain>[] = await getUserDomains(user)
-  if (userDomains.find(domain => domain.subdomain == subdomain) || (await process.superUserGranted(domain, user))) {
-    return await next()
-  }
-
-  throw new AuthError({
-    errorCode: AuthError.ERROR_CODES.SUBDOMAIN_NOTFOUND
-  })
-}

package/server/middlewares/graphql-authenticate-middleware.ts

@@ -1,13 +0,0 @@
-import { domainAuthenticateMiddleware } from './domain-authenticate-middleware'
-import { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware'
-
-export async function graphqlAuthenticateMiddleware(context, next) {
-  const { method, path } = context
-
-  if (method == 'POST' && path.startsWith('/graphql')) {
-    await jwtAuthenticateMiddleware(context, () => {})
-    await domainAuthenticateMiddleware(context, () => {})
-  }
-
-  await next()
-}

package/server/middlewares/index.ts

@@ -1,67 +0,0 @@
-import session from 'koa-session'
-import passport from 'koa-passport'
-
-import { config } from '@things-factory/env'
-import { SECRET } from '../utils/get-secret'
-
-import { authenticate401Middleware } from './authenticate-401-middleware'
-import { domainAuthenticateMiddleware } from './domain-authenticate-middleware'
-import { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware'
-import { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware'
-
-import { User } from '../service/user/user'
-import { MAX_AGE } from '../constants/max-age'
-
-const accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')
-
-export function initMiddlewares(app: any) {
-  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */
-  app.keys = [SECRET]
-  app.use(
-    session(
-      {
-        key: 'tfsession',
-        maxAge: MAX_AGE,
-        overwrite: true,
-        httpOnly: true,
-        signed: true,
-        rolling: false,
-        renew: false
-      },
-      app
-    )
-  )
-
-  passport.serializeUser((profile, done) => {
-    done(null, profile)
-  })
-
-  passport.deserializeUser(async (profile, done) => {
-    done(null, await User.checkAuth(profile))
-  })
-
-  /* passport initialize */
-  app.use(passport.initialize())
-
-  /* passport use session - for oauth transaction */
-  app.use(passport.session())
-
-  /* authentication error handling */
-  app.use(authenticate401Middleware)
-
-  /*
-   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.
-   * graphql app을 router에 적용하지 못하기 때문임.
-   */
-  app.use(graphqlAuthenticateMiddleware)
-}
-
-process.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {
-  subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)
-})
-
-export * from './jwt-authenticate-middleware'
-export * from './domain-authenticate-middleware'
-export * from './signin-middleware'
-export * from './webauthn-middleware'
-export * from './authenticate-401-middleware'